Multi-tenant retail POS SaaS

The hardest part was making multi-tenancy real all the way down to the schema, while keeping the cashier UI fast enough to use during a rush. PostgreSQL schemas gave clean tenant isolation, but every query path had to scope through the tenant boundary without bolting on a heavy ORM layer that would cost milliseconds at the terminal. The pricing engine had to fold happy-hour windows into the cart calculation without a server round-trip on every tap, which meant pushing time-window logic to the client with a single contract-tested source of truth on the server.

The second hard part was the PIN-secured role switch. A POS terminal stays logged in to a venue all day, but cashiers, supervisors and managers all touch it within a single transaction — a manager approving a discount, a supervisor authorising a void, a cashier completing the sale. Switching roles couldn't mean logging out; it had to be a PIN-bound escalation tied to a per-tenant role policy, with an audit row written on every step. That meant role authority lives at the session level, but every privileged action checks the live policy — and the audit trail names the human who triggered it.